Threshold cryptography can be used where multiple signatures are needed to generate a signature, and likewise where highly confidential documents should only be decrypted and viewed by a quorum. Furthermore, threshold cryptography can be used to provide a high level of key protection. This is achieved by sharing the key on multiple devices (or between multiple users) and carrying out private-key operations via a secure protocol that reveals nothing but the output. This provides key protection since an adversary needs to breach multiple devices in order to obtain the key. Threshold cryptography is of practical use, as can be seen by the fact that a number of startup companies are now deploying threshold cryptography for the purpose of key protection. One example use is due to the fact that Elliptic Curve Digital Signature Algorithm (ECDSA) signing is used in Bitcoin, and the theft of a signing key can be immediately translated into concrete financial loss. Bitcoin has a multi-signature solution built in, which is based on using multiple distinct signing keys rather than a threshold signing scheme. Nevertheless, a more general solution is obtained via threshold cryptography. Fast threshold cryptography protocols exist for a wide variety of problems, including RSA signing and decryption, ElGamal and ECIES encryption, Schnorr signatures, Cramer-Shoup, and more. Despite being a widely-used standard, DSA/ECDSA with distributed key shares has resisted attempts at constructing efficient protocols for threshold signing. This is due to the difficulties to calculate the curve points x1 and y1 without knowing the parameter k utilized to calculate the points with G, the generator of the elliptic curve.